Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

I need to display with milliseconds in a Timeline visualizations graph, is this possible?

0

I need to be able to see Milliseconds accuracy in TimeLine visualizations graph.

At the moment all events fall into a 1 second bucket, at _time is set this way.

so all events always start at the 1 second + duration. I want the events to start at the exact milliseconds. If i change _time to have %SN this does not add on the milliseconds. Even with the span=1ms. Is this possible?

Perhaps how in take the data in is not correct.TIME_FORMAT = %s%3NTIME_PREFIX = \"startTime\":

People who like this

2 Answers

You cannot force something to be there that is not. You need to make sure that the original events contain millisecond granularity. Do they? If they do, then you need to make sure that Splunk inputs.conf is properly configured to receive ms into _time so that the events in Splunk have ms granularity. Have you? Even so, it is possible that tstats does not support ms, but I think this is unlikely, given that this works for timechart and other commands.

If your data itself does not have granularity till milliseconds you will end up getting .000 in your visualization. Do you really want to show milliseconds when it is not present?

You can choose Axis Time Format and Tool Tip Time Format as SECONDS instead of SUBSECONDS, to get your timeline visualization in sync with your data, otherwise resort to @woodcock 's solution of configuring your inputs.conf/props.conf to receive ms in _time.

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here. Closing this box indicates that you accept our Cookie Policy.